Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
7c58699b3ed16c159210d7d23a725762_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c58699b3ed16c159210d7d23a725762_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7c58699b3ed16c159210d7d23a725762_JaffaCakes118.html
-
Size
66KB
-
MD5
7c58699b3ed16c159210d7d23a725762
-
SHA1
03d74e30f1ab0be136136d1a0a9e4c9b326d5e68
-
SHA256
65ba74de95270a715e308c3799cf90e32b556cca29114f9e30d78ccc22d5d1f2
-
SHA512
ce6debe79a9b92ed463df14f46f78354bb8c63bf54c09e86f77bc6e5f1f26d295e0c6fbf85d7f9adadcb8cda5f7085d51d60a3499d7ef045bb678979ab0fa69d
-
SSDEEP
768:JikIgcM0St8tN99OIs4+1Ym1oTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/Ijh:J/D+oDyTIgec0tbrgaCcFNnzAC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c048a251dab0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000acf96fe6c21c08858acdbc0f06de8cad6ed01135ef1ba5b1cfc79386d614fe36000000000e80000000020000200000001f9978fb612d5e7aa007308e03bb18f8f01b0da4c95390c86454cd4e5a3a318c2000000093ef453be713c46cb17cb1d24dad33ab3a62a182dfa55d3ab2ff5fba87b3dd4c4000000039f5d8f87403c63e14e989790ca7387b2c7f5b759206d673c0840c06a9c036a0a5c70ce0293a1cddba72176dfe7584ed99725ca9942f4aca7df8a39022b7c958 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fa404f4067101ac59e11b3b42422f8436bbc8ec5b711b16a19d92e33e889726f000000000e800000000200002000000084d0e9d030ab33bfe8238ab7c7552181563ec7a041bbac9aeb06be8b515da36b90000000697b061b12584474b5a83957c84372ebef071f20752f34496bc21a0267e90e71d8b460bf281f9645381eee108ee567bd3a3e732d0a1b086b218c92ba803a534f8d48d23876f62c15243907a6236e4972af80b504d41c2e48e21bb55094bd77e9ac520c5e9ff70868a9f0f87bfbcf3c49c0717387e4807c0ce4176cc1c1cba61d2653d4c0613673cc2071dc62c99ff55c4000000007cd70d941e4e4f04846c4ffb3c8452855ed2214043d3da7f19c415abb00d6d2b5c03fb6f1c6eeb5d3a5dff46c9c83d570d9073b3baf6bc196c41de4734994d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D0DF9A1-1CCD-11EF-B27B-DA219DA76A91} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423047303" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2072 iexplore.exe 2072 iexplore.exe 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2644 2072 iexplore.exe 28 PID 2072 wrote to memory of 2644 2072 iexplore.exe 28 PID 2072 wrote to memory of 2644 2072 iexplore.exe 28 PID 2072 wrote to memory of 2644 2072 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c58699b3ed16c159210d7d23a725762_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb9b7308f4c6ef2905af164b2a5f6284
SHA14551d0f1efad3a77b103d9e97247e5d922ea5a88
SHA25627658a5cfaf8f9ca1d30986a59a53c8f53ff129e62c8e49359eaf92719d52444
SHA5120e6e07e6f5527d8a01f4c7a435d2e9b6cc6090a087e28419f7b0fc2a90009328c6e63eefaa1423dcf84307493f8fd29ce974042cdcd5c0a0c122f900f549828b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d10ed9308b852615621398bce6b28851
SHA1042d4890d71325c583b43c53c6bc426b4857320b
SHA25662fcd6563e7cd08908e8911bdcbf9c4dd80bdc402aa3dfd98f6945c36bc50889
SHA512a38266c514bece8cebd1febaad9116760a8313d48f1852baf92d4bb4ba0690b237fd44ff10ed542b93db873c593adff66e8537cd37945a7dd871ef3ddc2e36e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f2274fa5ed4acfc19ec06fdb77cae93
SHA1bb267aa301ac2bec0484c824fdd0c804c3e45a2c
SHA2568ff3f12473e59b9ef32034f94067924cdfca356566e7a2610d1e91d2365fe05b
SHA512e5128c0dbbe7e5c41bc3f192a7d83af42423bde8ad115bbc3d415f95cc6a2c99471554b5f7c76bf4635e0232fdfccf01b850238791263f8e384837a82c2570cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e32d0c23620579cb290f029668b37019
SHA180cd1cccd5812dba1fd73ce7334823c6c05f3bc6
SHA256b220c5ff6960d50d2702c8a5536e6edee94192a1f162baf1bbb544e0254c7059
SHA512f82a829b180345662edad085b6f174d59a03ac0ebc6691756db8a00e9cad2c3e0471bd8575109caf450c6ac83c747dd066a55b3491bffced22a153d58d57d1d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55171ce7634d0bdedc5bc9088ac6475a2
SHA15788c9df34da0a0f9b8266d1e39f3c99207b896e
SHA2562a3753c046e8a6aa823fccfcff7b24343de023f27b22039baa6806a2654783aa
SHA51245d326e39a23bb875918439d5a590ced8394166158be5d9cb022eb46e10a482655951489e07ebc7fce207940f79101125d92d7481e1761804d6d83f153d98601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f39858ec792dbf9f43d9a541bbf43197
SHA1061d765bc03d5eb4b0d9dbaf8fe8181b177fe4b9
SHA2567eb8b379b7b2a9538489bcb421b5168f245db514bba13ddb892d90c3720c36b4
SHA51298f6b67a72d00efd06787c69397bcdb1574a6322fa9583a4d59f0043108ca65b6650dcd428e5a65e1f41e9fd67183daa533b5c295abf6325fdd8640932d8f171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dd640569f0839ada4a4176e64fadc3b
SHA1ce8ec9a9b81dfb441ce2653deb9206870af2bde9
SHA2564c6f04e0b4c14997c0ffeca36a023cfb192f50590561e626722865003bca2b01
SHA5123daeecd08a7e9d6f6fb1e7f3a45d633acc2053885a222885523571d7544d966fa75ec6a171a918b27c3fe13ab58ef58c5d8608a24e020ae12f6a953111cffcb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57133723ca9e592bdf7208803911fe1ce
SHA1b82d7a88debf372aa682826afb716b5ff22bafb6
SHA256e5925b176586f5d1e245c723ea02e033eed187c74e72d0eea01c65f2464fe6c8
SHA512b892ebaf00f77720ae6f7fa328fd7bb5f257e9d84230b2530c664e48182379496ac2df3e43e15e3dc4515e80bf1346f49d5d49f3e321c7533c4df026c7be1850
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562366fbf29f7d00ca7ba10092a1675a4
SHA19e92d1ad4908e12d1408cf3641cae27ca6efa944
SHA25668b2e751ca6c821caeac807440033f5a368050ca82df8be41466186340993cb5
SHA512378f0ff308e807a71e5985f67ee0687d301d004e7d14cace859d710f6b2ebcf0749a14b03f61f3da8ae191367e001cca12f189a9152de3b55ad80b8f76e9c513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5566c7415897ba8b2f3e72a9ec57754ba
SHA1691ac2fc3c26329e5a2174868659d719f5b3cf1a
SHA25619fe1533a6ffec67f51e2218ce8ad5e9c9c87f4af8b3af4986b9fdf7af87ec52
SHA5122ea3551cb6624d7d6f55fba2c66582589a6c20475c36fb3625b944002989dd35be1179d371b8ea94c0762777a138ed09492dac96ab47159c497b741666446c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5756283062d5bfa2d82305f6a90146ff7
SHA1bcff13e5ba693f64d911baa33fff3536e828d97f
SHA256b4ba34023fa5de3441bac6bddf453ce37974b2a4be5d8182328ec2047d93d5db
SHA51255ac480a0b480066b46d5648bc330d6b641e1b470c3f66d66a66d7bf554d8800261966af3d053f88ee1e0b991cbdbf0bce33dcd0b8e4396b4d56b5aaaae9f676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5457067c784cb391d358bb2cc29bf42b6
SHA1ab2d1663a3d80515a8eb90bce0f705a68c0c916a
SHA25696f62ec909df260ad48425a6dd7a37604cd709dbb05b70e0ed6bfc2f090a6708
SHA512d7b452c45426deb5e7486437e7560357cd2309f23b134b5c3f65ffbdca0ea377724036d0fda7682617c42738abfdaeb2711001d71c1510a8e2c83252140bc6e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b987a02049ed80c9ed2e08e341758bbd
SHA1f49cf083e2b6d11ece25c17cc7d2aa55a897d318
SHA256caf22e50ec02a2fcfbe2cba1c452854670f87eccf635c4198cff7ec756433a37
SHA512ff5214900672335aaed06c81e2053ab2a788e8ce0aebc9482ffd03adeb6f9fed40eff41929ea7668860262dc9d84d2574b03ea9984cb3f8a90b9f1db4bdddcaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ad8a39a5b6d5dd37f72707e14d626f
SHA1938e0d09cac435560e0b45a55d003b2e47c09fa2
SHA256b84cd0386e6ebee7de371973cf1c05de2207bbb55dc9889657a7278813ce0c06
SHA512449ffff31a1185ed89f0af6ac2e9c3bbb251718fce193cee1714123fe2016ab6134f4e786f2e3a94c0b2fc049813ed3fc224f7cd6b83734c50804ebc0aaef4f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c924258ad27a0585a424a53c9c6ebda1
SHA1942c0a50288a02b79c11d5777c815bf79c229f7e
SHA25612e7608b3e7aedd63cc49b4aa59e5047da3857003070677037a3b814ce0f1616
SHA512a2341973ce539a9f6d94d1e98ec40d4c5331f35b0ccd8ed43a6d5394843026c97144f97a8eeda1c0ba72e18b29718d55db5e223914b931ec5b16b607e0ce7a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cabab2a06cc93b4c5a1b54184cf78291
SHA1d5b9f5dbe417eb354144d177c0c04722b9a220c7
SHA256966892e734679776fdb1437ad3af9f822538ed5f269259df483dfb3492817eee
SHA512f202e05710975f50c0d395be921bee57be5c06df2dedcb7f59e6f1b2e1b6fc6104115b72060dd74de0af403317e8d8120a2ce963d53ce793585d276fab9e41d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56900c297f849f831d3bdc656d52539fa
SHA1adec923d61a3eb4f9d2f66f2ad1c746aa1bc8ba0
SHA256c37e3f97d47cf45e03891a612b00ab0391c0084ca463cca4c33333c60b1ccc8a
SHA512ea95372c2930bc8197eea4bdfc477d4c6527cda72ed3356eb44b64b6f2e80fc9d63a6d9b5b44e1227a3f86b83b1cd87c3774c3687bcde1126db36d36efb5f36e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d43cd1a7133eb9c0b0058e22f89cc50
SHA1875581ad216cbb38ea6c5115a562f1185d2e0365
SHA25601a244fd350d2458545ec5639936299b916ec20ad556380c9dae0800cf565e99
SHA512f9f30cf6105f244db42afb285dade8bff0751f5d8c5113d9c53e99fb113de13d4ffc3cc61c1fea4b5d91f4e93d1fff72652c06ebfbab736e11b0c4385e079cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5607b0d7cea2381c5d28539915081cde5
SHA1cd79792b7f04c9fe761aa0096c0e79cd1df85047
SHA25602238a119d77dd63d62aba015011dd2091d431f1c27e6673f0b97ecbf103cea9
SHA512d98141a5871a660a613432fff5636272cd866865e027e521281791e305b2320561f32ef4beffd4daa65efdbae1c520539bd09c4a30eb761bf2c4fe9701fd044d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a